Loading
Microsoft 365 default settings are designed for convenience, not security. Here's what to change to actually protect your business.
Out of the box, Microsoft 365 leaves these security gaps:
MFA blocks 99.9% of account compromise attacks. This is the single most impactful security change you can make.
Recommended: Use phishing-resistant MFA (FIDO2 security keys or Microsoft Authenticator with number matching) instead of SMS codes. SMS can be intercepted via SIM swapping.
Disable protocols like POP3, IMAP, and SMTP auth that bypass MFA. These are the most exploited entry points.
Only allow access from devices that meet your security requirements (updated OS, antivirus, encryption).
Use Azure AD Identity Protection to automatically block sign-ins from suspicious locations or compromised credentials.
Require MFA + compliant device + specific IP range for all admin portal access.
Enable impersonation protection in Microsoft Defender for Office 365. Add your executives and key partners to the protected users list.
Enable URL rewriting to scan links at time of click, not just at delivery. Attackers commonly weaponize links after the email is delivered.
Enable dynamic delivery or block mode for attachments. This detonates suspicious attachments in a sandbox before delivering them.
Block automatic email forwarding to external domains. Attackers set up forwarding rules to exfiltrate data after compromising an account.
Configure all three email authentication protocols. Microsoft 365 supports DKIM signing natively through the Defender portal.
Audit logs are essential for incident investigation. Without them, you cannot determine what happened during a breach.
We configure and manage Microsoft 365 security for businesses. From initial hardening to ongoing monitoring, we make sure your M365 environment is locked down.
One email per month with our best articles. No spam.